At 3:00AM, you are abruptly woken by the continuous ringing of your cellphone. It is Tony, your Chief Information Officer (CIO). You have only been the Chief Executive Officer (CEO) for a little over 5 months now, barely enough time to get your feet wet, let alone figure out how to deal with this dilemma.

As you race to get into the office, Tony has informed you that at 2:00AM, cybercriminals ransacked the hospital database breaching the data of roughly 100,000 patients. The attack has prevented organizational access to patient files, medical images, and details of patient visits. Accessed files contain personal information including names, addresses, Social Security information, dates of birth, contact information, diagnoses, treatments, medications, and other medical information.

The cybercriminals responsible for this attack have demanded a hefty ransom with a 24-window to pay. Failure to comply, according to the cybercriminals, will result in the private sale and distribution of all breached data. The cybercriminals reassure you however, that all data will be returned untouched if all stipulations have been met.

By 5:00AM you make it to the conference room to meet with your executive leadership team.

Your legal team is expected to call at 6:00AM.

While you are in conference, the manager of the local news station calls to schedule an immediate meeting, claiming that this breach is public information.The leadership team looks to you for direction.

In the following discussion, address the following:

• Support or refute the claim that the CEO of the hospital should pay the ransom to the cybercriminals responsible for this attack.
• Using an ethical decision-making model, discuss implications of your decision.
• How would you handle the media?
• Who would you involve in this scenario?
• If you were the CEO in this scenario, what would you do from the moment you received the call?
• How can you take this week's discussion topic and apply it in the real world?